Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

441–450 of 621 posts

Re: Kill The Cookie Banner

#441

Post by kalleboo »

ApolloFortyNine wrote: post #438
kalleboo wrote: post #428

Earlier quoted context omitted.

What if I want to start a restaurant that can only make money if I use expired ingredients, run the fridge at a higher temperature to save on electricity, and don't waste my employee's time by washing their hands? These food safety laws mean my business model doesn't work. I simply will have to go out of business.

This is just a strawman, these aren't equivalent and I'm not going to waste time pretending they are. Might as well just compare ads to nuclear weapons at this point.

There are enough libertarians out there that believe that the government should not be involved in food safety inspections to establish that regulations like this ARE on a related spectrum. Do you have a right to trust that food you buy is safe or should you get to choose to buy raw milk? Do you have a right to consume online services while retaining privacy? It's a debate society constantly has, and the EU electorate has chosen the side of privacy over a specific business model, just like most developed societies have chosen food safety.

Re: Kill The Cookie Banner

#443

Post by bee_rider »

otterley wrote: post #241
bee_rider wrote: post #228

Earlier quoted context omitted.

I don’t see how we could possibly prove that the person who clicked “I agree” is still the person using the computer. Or that any actual human is aware that an agreement was made (since an AI can find a checkbox nowadays or software can be configured to bypass it). One way to add balance could be to require people asking for contracts to actually treat them like real serious legal documents, show up for the signing,…

That doesn’t matter. If you authorize an agent—human or mechanical—to enter into agreements on your behalf (even by mistake), and the agent presents itself as operating on your behalf, the agent’s decisions will be treated as though they were your own. Prinicipal-agent law predates computers by a very long time.

What if an IT guy installs one of those “cookie banner be gone” extensions without the user’s permission?

Re: Kill The Cookie Banner

#444

Post by tacitusarc »

otterley wrote: post #395
tacitusarc wrote: post #375

Earlier quoted context omitted.

I think that means one of three things: the court system is broken, you are wrong, or I failed to be clear and you misunderstood me. So, to be clear, if a company buries or obscures terms while making it seem like they have presented them, so you agree without reading the actual terms, you cannot defend yourself by explaining that situation?

One possibility you failed to enumerate was that you are wrong. But anyway. What exactly do you mean by “buried or obscured”? As I said above, if the parties cannot be said to have an agreement because the terms of the agreement itself are inscrutable, then that would probably result in no contract being formed, or the terms at issue interpreted in the light most favorable to the non-drafting party. Like if the terms…

A more concrete example may be useful to explain what I’m thinking. A company has you click to agree to their TOS. They link a doc, which is of course quite long. That doc has a footnote which links to another doc. You do not read the secondary doc, and it is the contents of that doc that allows the company to sell you data/prevent you from suing them/harvest your organs/abduct your family/whatever. My point is that “I did not read the document” should be a valid defense, such that if it is not I believe the law around this is wrong.

I suppose you can claim I am wrong to believe that, but it is accurate for me to state that I _do_ believe it, which is why I didn’t list me being wrong as one of the possibilities. Practically speaking, that is the first possibility I enumerated.

I should note that in my example, imagine neither doc is any more inscrutable than all the TOS we encounter in the wild, instead it is the construction (the fact it is a footnote link) that makes it easy to miss the additional doc.

Re: Kill The Cookie Banner

#445

Post by unscaled »

zugi wrote: post #321
xp84 wrote: post #288

Earlier quoted context omitted.

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie…

> Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you Exactly. I use the "I don't care about cookies" extension, which rejects most cookies automatically without me having to see the popups. But even accepting cookies is fine - I'll be closing my browser soon anyway and they'll be gone.

Despite this being called a "cookie banner", this is not _just_ about cookie. When you click "Accept all" you are giving your consent to any form of tracking and information sharing mentioned in the details. The site you visit may share everything they know about you with any third party they mentioned. They can even use fingerprinting (if you've agreed to it) to keep tracking you after you've deleted the cookies.

Re: Kill The Cookie Banner

#446

Post by chillfox »

kleiba2 wrote: post #143
chrismorgan wrote: post #60

The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them…

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

The amount of sites that don’t persist rejecting feels very high, or it’s extremely painful when encountering. The cost of clicking reject is extreme if you have to do it on every page load as you navigate a site.

Re: Kill The Cookie Banner

#447

Post by charcircuit »

TheCoelacanth wrote: post #277
charcircuit wrote: post #188

Earlier quoted context omitted.

If you want to prevent a single user hitting F5 a million times from messing with your analytics you need to track IPs which requires the banner.

No, you don't need consent for that. It falls under the legitimate interest exception. You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.

>It falls under the legitimate interest exception.

What makes that a legitimate interest and not advertising?

Re: Kill The Cookie Banner

#448

Post by jebronie2 »

jeremyjh wrote: post #408
jebronie2 wrote: post #327

Earlier quoted context omitted.

No, you need to always ask for consent for cookies if they come from a third party, regardless if they are only required to enable functionality. You also need to ask for consent each time data leaves the website (for example when loading an image from a third party host). You can't even load a font file from a third party server because the users IP reaches that server without consent. Cookie banners don't just hand…

Putting assets on a 3rd party server is indeed a great way to track people. They can completely fuck off with all of that as well.

That's the problem with the regulation: It defines how data can be legally transmitted instead of defining only how data can be legally used, resulting in nasty side-effects like making embedding third-party content illegal even if its not used for tracking.

Re: Kill The Cookie Banner

#449

Post by jebronie2 »

kodebach wrote: post #342
jebronie2 wrote: post #327

Earlier quoted context omitted.

No, you need to always ask for consent for cookies if they come from a third party, regardless if they are only required to enable functionality. You also need to ask for consent each time data leaves the website (for example when loading an image from a third party host). You can't even load a font file from a third party server because the users IP reaches that server without consent. Cookie banners don't just hand…

Well if the cookie comes from a third party it implicitly allows tracking. Also AFAIK the Google Fonts question (is the IP alone already PII, if Google has no way of tying the IP to a person) has not been decided by the ECJ yet. There've only been decisions by lower level German courts that are still in dispute.

IP addresses are PII according to german law, that debate has been settled long ago by final court-rulings afaik.

"Well if the cookie comes from a third party it implicitly allows tracking."

Yes, because this makes tracking possible you have to gather consent first, regardless if tracking actually happens. Very bad solution, they could just define how data can be legally used, instead of also overreaching by defining how data can be legally transmitted.

Re: Kill The Cookie Banner

#450

Post by unscaled »

smallmancontrov wrote: post #406
Aerroon wrote: post #400

Earlier quoted context omitted.

If they fully anticipated this then surely they could've fully anticipated how annoying and useless cookie banners are? There is nothing stopping a website from using cookies regardless of the banner. If they are outside EU jurisdiction then there won't be any consequences either. The legislators were and are dumb. They have wasted an enormous amount of collective time for no benefit . Big corporations continued doin…

> surely they could've fully anticipated how annoying and useless cookie banners are They did. The laws were airtight in this regard. They simply lost -- whether through a last minute "tweak" or undermined enforcement mechanism I do not know, but I do know that the current state of affairs was fully anticipated and headed off at the point where I reviewed the proposal. Your vitriol is bass ackwards -- the lesson is t…

The law is airtight. Acceptance must be informed and freely given (this includes forcing through dark patterns and annoying banners that force you not to read), and withdrawal should be as simple as acceptance.

GDPR article 7 and its various recital already include that. GDPR wisely doesn't get into technical details like "cookie banners" anywhere, but various national agencies did set guidance and it's usually quite explicit: Rejection must be as simple as acceptance and reject buttons or link must be as prominent as the accept buttons and links.

For example, CNIL, the French data privacy authority, clearly says[1]:

"The CNIL has received complaints about dark patterns on cookie consent banners encouraging data subjects to accept cookies.

As a reminder, with certain exceptions, cookies can only be used with the consent of data subjects. Moreover, rejecting cookies should be just as easy as accepting them."

And gives examples of dark patterns such as different button sizes, multiple accept buttons, hidden reject buttons, etc.

The law and specific guidance is pretty unambiguous. This purely an enforcement problem. The regulatory bodies do not have the resources to go and chase most individual companies, and the non-profit NGOs that go after the violators apparently don't have the budget to make enough impact and scare companies into compliance.

[1] https://www.cnil.fr/en/dark-patterns-cookie-banners-cnil-iss...

Post reply on HN